h8-536-decoder/docs/pt2-knee-rom-trace.md

PT2 KNEE ROM Trace

Date: 2026-05-26

Short Version

KNEE is not a simple held selector bit. The ROM has a dedicated local panel-input handler at loc_1795, reached when the panel input word at F104 changes. That handler uses CCU-side selector state as gates, then either shows a short timed KNEE page or reports a KNEE value change on selector 0x00BC.

This explains the bench pattern where KNEE AUTO can light or flash and then clear even while serial traffic remains healthy: one ROM path is a timed display/page override, not a maintained lamp value.

Input Path

The local panel path is:

F104 changes -> F692 updated -> F6F0.1 set -> main dispatcher calls loc_1795

The important code anchors are:

3B33  MOV:G.W @H'F104, R0
3B37  CMP:G.W @H'F692, R0
3B3D  BSET.B #1, @H'F6F0
3B41  MOV:G.W R0, @H'F692

1630  BCLR.B #1, @H'F6F0
1636  JSR @loc_1795

So serial writes can prepare the state table, but the main KNEE control branch appears to require the panel-side input lane to change.

Handler Decision Table

loc_1795 reads two words from the primary selector table:

ROM read	Selector meaning
@H'E172	E000[0x00B9]
@H'E220	E000[0x0110]

The branch is:

1795  if F731 > 2: skip
179C  if E000[0x00B9].13 == 0: loc_2127()
17A7  else if E000[0x0110].15 == 1: loc_2127()
17B2  else:
        delta = F692 - F6B2
        report/update selector 0x00BC via loc_19A2
17C0  F6B2 = F692

Practical interpretation:

Condition	ROM effect	Current meaning
0x00B9.13 = 0	timed KNEE page via loc_2127	KNEE value reporting not enabled
0x00B9.13 = 1, 0x0110.15 = 1	timed KNEE page via loc_2127	override/inhibit mode
0x00B9.13 = 1, 0x0110.15 = 0	value delta reported as selector 0x00BC	likely live KNEE control/report lane

This downgrades the earlier bench label that treated 0x00B9.15 as the main KNEE gate. The ROM gate for the panel-input handler is 0x00B9.13.

Timed KNEE Page

loc_2127 is the timed page path:

2127  set FB03.7
212D  save old F732 into F734, if this is a fresh override
2135  F732 = 0x1C03
213B  FB02 = 0x14
2140  call loc_48FA

The timer path later decrements FB02; when it expires, loc_48EF restores F732 from F734 and redraws. That is the likely cause of "lights, then falls away" observations.

The LCD dispatcher confirms F732=0x1C03 is a KNEE page:

493E[0x1C] -> 0x92CC
0x92DE[3] -> 0x95CE
0x960B prints "KNEE"

On that KNEE page, the second line is selected like this:

if E000[0x0110].15: "DL"
else if E000[0x00B9].15: "PRESET"
else: "AUTO"

So 0x00B9.15 still matters, but it appears to choose the KNEE page label (PRESET versus AUTO) rather than enabling the report path. 0x0110.15 selects the DL label and also forces the timed page path from loc_1795.

Bench Implications

Useful frames to test this model:

Purpose	Frame
clear 0x00B9	00 01 39 00 00 62
set 0x00B9.13 gate	00 01 39 20 00 42
set 0x00B9.15 label bit	00 01 39 80 00 E2
set 0x00B9.15 and .13	00 01 39 A0 00 C2
clear 0x0110	00 01 90 00 00 CB
set 0x0110.15 override	00 01 90 80 00 4B
read 0x00BC	01 01 3C 00 00 66

The most direct live-control test is:

1. Reach CONNECT: OK.
2. Send 00 01 39 20 00 42 to set 0x00B9.13.
3. Send 00 01 90 00 00 CB to clear 0x0110.15.
4. Move or exercise the physical KNEE-related control, if available.
5. Watch for TX/report traffic around selector 0x00BC.

If no physical KNEE input is moved, the ROM may not enter loc_1795, because the trigger is the F104 panel input change path rather than the serial write itself.

Bench Observation: DTL / KNEE

The first knee-rom-gate-and-value-probe bench run produced a new LCD state with DTL on the left and KNEE on the right. That is an important confirmation: page 0x1C contains both a KNEE entry and a DETAIL entry.

Relevant ROM text and page entries:

0x92DE[3] -> 0x95CE  KNEE page entry
0x92DE[7] -> 0x97C8  DETAIL page entry
0x960B prints "KNEE"
0x9805 prints "DETAIL"

The bench display probably shows the page-0x1C menu neighborhood, with DETAIL abbreviated as DTL and KNEE as the selected/right-side item. The log does not encode LCD pixels, but the serial timing around the observation is consistent with the KNEE probe:

00 01 39 20 00 42  ; set 0x00B9.13 gate
00 01 39 A0 00 C2  ; set 0x00B9.15 + 0x00B9.13
00 01 90 80 00 4B  ; set 0x0110.15 timed KNEE/DL override

Next isolation target: determine whether DTL/KNEE appears from 0x00B9.13, 0x00B9.A0, 0x0110.15, or only the combined sequence.

Panel Correlation

The physical panel has both DETAIL and KNEE buttons near the LCD. That matches the ROM page-0x1C neighborhood and makes the observed DTL/KNEE state likely to be a local menu/button context rather than a generic lamp status.

Practical implication: once the CCU-side selector gates are prepared, pressing the physical DETAIL/KNEE buttons may be the missing F104 panel-input transition that calls loc_1795. If so, the useful evidence should be:

• visible LCD movement between DETAIL and KNEE entries,
• possible KNEE timed page redraws,
• TX/report traffic for selector 0x00BC when KNEE input movement is accepted,
• or other page-0x1C selector reports from neighboring DETAIL/KNEE controls.

Follow-Up: Lamp Without LCD Movement

The follow-up run after discovering the DETAIL/KNEE buttons did not reproduce an LCD page change. The observed result was:

• only the later KNEE cases/windows illuminated the KNEE AUTO lamp,
• none of those cases changed the LCD.

Current interpretation:

• 0x0110.15 is still the strongest KNEE AUTO lamp/status source.
• Serial table writes can light KNEE AUTO without necessarily entering the LCD DETAIL/KNEE page.
• The LCD path probably needs an additional local-display/menu condition, not just the CCU-side selector bits.
• The physical DETAIL/KNEE buttons may be scanned by the local panel path, but in this test they did not create a visible LCD transition or new serial report evidence.

This separates two related but distinct paths:

KNEE AUTO lamp/status:  mostly selector/table driven, strongest source 0x0110.15
DETAIL/KNEE LCD page:  local page/menu context, likely page 0x1C plus panel/menu state

Next ROM target: trace the DETAIL and KNEE button scan bits through the page-0x1C menu dispatcher, not just the loc_1795 KNEE value handler.